tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.

The remote host is affected by the vulnerability described in GLSA-200711-19 (TikiWiki: Multiple vulnerabilities)

    Stefan Esser reported that a previous vulnerability (CVE-2007-5423,     GLSA 200710-21) was not properly fixed in TikiWiki 1.9.8.1     (CVE-2007-5682). The TikiWiki development team also added several     checks to avoid file inclusion.
  Impact :

    A remote attacker could exploit these vulnerabilities to inject     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200710-21 (TikiWiki: Arbitrary command execution)

    ShAnKaR reported that input passed to the 'f' array parameter in     tiki-graph_formula.php is not properly verified before being used to     execute PHP functions.
  Impact :

    An attacker could execute arbitrary code with the rights of the user     running the web server by passing a specially crafted parameter string     to the tiki-graph_formula.php file.
  Workaround :

    There is no known workaround at this time.

The remote host is running TikiWiki, an open source wiki application written in PHP.

The version of TikiWiki on the remote host fails to sanitize input to the 'f[]' parameter of the 'tiki-graph_formula.php' script before using it as a function call.  Regardless of PHP's 'register_globals' setting, an unauthenticated attacker can leverage this issue to execute arbitrary code on the remote host subject to the privileges of the web server user id.

ID	Name	Product	Family	Severity
28219	GLSA-200711-19 : TikiWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27553	GLSA-200710-21 : TikiWiki: Arbitrary command execution	Nessus	Gentoo Local Security Checks	high
26968	TikiWiki tiki-graph_formula.php f Parameter Arbitrary Command Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2007-5423

critical

Tenable Plugins

high

high

high